Product

Horde Virtual File System (VFS) API < 3.0.1

1 brief RSS

CVE-2026-60102: Horde VFS OS Command Injection Vulnerability

CVE-2026-60102 describes an OS command injection vulnerability in the Horde Virtual File System (VFS) API before version 3.0.1, specifically within the Horde_Vfs_Smb driver, which allows authenticated attackers to inject arbitrary shell commands via user-controlled filenames during file operations, leading to arbitrary command execution on the underlying system.

Horde Virtual File System os-command-injection rce webserver horde cve

1r 1t 1c 45m ago